Red Hat Bugzilla – Bug 858406
PostgreSQL PITR setup with SELinux feature request
Last modified: 2014-09-30 19:33:50 EDT
Created attachment 614140 [details]
Sample module outlining all the permissions required for PITR implementation with SSH and RSync
Description of problem:
Currently RHEL-shipped SELinux policy is not set up to work with PostgreSQL's PITR (point-in-time recovery). In order to apply most common methods for PITR implementation one needs to manually generate corresponding module. From information I've gathered implementation ends up being fairly similar in each case thus may warrant a tunable implemented in default policies to allow PostgreSQL to transfer WAL files to the secondary node[s].
In my particular case I'm implementing PGPool-II replication with PITR. (Following documentation at: http://www.pgpool.net/docs/latest/pgpool-en.html#online-recovery ).
Version-Release number of selected component (if applicable):
Steps to Reproduce:
1. setup PGPool-II and PITR recovery as per http://www.pgpool.net/docs/latest/pgpool-en.html#online-recovery
1a. namely add to /var/lib/pgsql/data/postgresql.conf:
archive_mode = on
archive_command = '/usr/bin/rsync %p email@example.com:/var/spool/pgsql/wal/%f < /dev/null'
which essentially asks postgres to send WAL files over to the secondary machine whenever it reaches checkpoint.
2. launch "psql -U postgres template1" on one of the nodes
3. => select pg_backup_start("backup_test");
4. => select pg_backup_stop()
WARNING: pg_stop_backup still waiting for archive to complete (60 seconds elapsed)
and a lot of SELinux denials
operation to succeed.
PGPool-II used is built using SPEC file in bug #847357 which essentially is a Fedora package rebuilt and tweaked to work in RHEL
Ok, I added a new
boolean to Fedora. Will backport to RHEL6.
I like this solution more than was my first.
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory, and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.